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Introduction 

Section 23-7-41 1, MCA, in part, requires the Legislative Audit Division to conduct or have conducted a 
comprehensive audit of all aspects of security in the operation of the Lottery. In accordance with statute, 
we recently reviewed Montana Lottery (Lottery) security. This Audit Committee memorandum outlines 
the findings of our review and constitutes compliance with statutory reporting requirements. 

Scope and Methodology 

The audit was conducted in accordance with Government Auditing Standards published by the United 
States Government Accountability Office. We evaluated the control environment using state law, state 
enterprise security policies, Multi-State Lottery Association rules and industry best practices as criteria. 
We performed interviews of Lottery and vendor personnel to determine how controls function. We 
observed and tested the operation of Lottery security controls including: 

► Scratch game ticket development, shipping and activation processes 

► Physical access requirements 

► Lottery network access requirements 

► Winning ticket payment processes 

► Unclaimed Lottery prize management procedures 

► Lottery drawing procedures 

► Personnel hiring procedures 

We also reviewed the implementation status of prior audit recommendations which is a standard part of 
the Lottery Security audit. 
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Findings 

Based on work conducted, we identified six areas of improvement warranting management attention, 
two of which Lottery resolved during the audit. The resulting four areas included: 

► Physical access to Lottery vendor facility 

► Segregation of duties related to scratch tickets 

► Vendor notification and Lottery documentation of system access 

► Regular monitoring of vendor access to Lottery systems 

Conclusion 

Overall, Lottery security controls are in place within those areas outlined in statute; however, the 
implementation of controls can be improved to better adhere to Multi-State Lottery Association rules and 
industry best practices. Existing controls can be strengthened and reviews can be performed to ensure 
Lottery security controls function as expected. Upon completion of audit work, we issued a management 
memorandum to Lottery officials outlining our findings and suggestions for strengthening controls. 
Lottery officials reviewed and acknowledged our findings. 
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